Docs Pro-Tips Whitelist possible flaw?

[jurkan]

http://raven-js.readthedocs.org/en/latest/tips/index.html

If it's parsed as regex, wouldn't the example whitelist also match yourexample.com, which could be registered by a completely different person?

[mattrobenolt]

Yeah, you're right. :) I'll fix.

[robinwassen]

I would close this issue as won't fix, because it can't be exploited for anything at all.

And if someone as a script kiddie want to go around the check on his own client, well, just modify the whitelist instead of including stuff from other domains.

[mattrobenolt]

Yeah, it doesn't really matter. It has nothing to do with authentication or anything like that. It's all backed by authentication on the server. This whitelist is just to block out noise from errors that you don't care about. --
Sent from Mailbox

On Fri, Aug 22, 2014 at 12:30 PM, Robin Andersson
notifications@github.com wrote:

I would close this issue as won't fix, because it can't be exploited for anything at all.

And if someone as a script kiddie want to go around the check on your own client, well, just modify the whitelist instead of including stuff from other domains.

Reply to this email directly or view it on GitHub:
#226 (comment)